U.S. Pat. No. 6,792,545, assigned to the Assignee of the present application, discloses a system and method for performing secure investigations of networked devices over a computer network. This patent discloses that investigations of computer media may be conducted by obtaining raw sectors of the computer media and making full bit copies of such media. However, it may be desirable to obtain and preserve only particular files from the computer media, and to do so in a forensically sound manner.